What is the CVSS score of CVE-2026-20677?

CVE-2026-20677 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Apple are affected by CVE-2026-20677?

A critical race condition vulnerability affecting Apple's macOS, iOS, and iPadOS platforms could allow attackers to bypass security controls through symbolic link manipulation.

How to fix or mitigate CVE-2026-20677?

Within 24 hours: Inventory all affected Apple devices (macOS Tahoe, Sonoma 14.x; iOS/iPadOS 18.x; visionOS 2.x) and assess business criticality. Within 7 days: Develop patch deployment plan prioritizing high-risk systems and enforce mandatory device updates through MDM policies. Within 30 days: Complete patching of all in-scope devices to macOS Sonoma 14.8.4 or later versions; verify patch compliance through endpoint monitoring.

Apple CVE-2026-20677

CRITICAL

Race Condition (CWE-362)

2026-02-11 product-security@apple.com

Apple Race Condition Authentication Bypass

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

CRITICAL 9.0

DescriptionCVE.org

A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3. A shortcut may be able to bypass sandbox restrictions.